Add CODEOWNERS for security-critical paths

.github/CODEOWNERS

@@ -1,6 +1,2 @@
-# See https://help.github.com/en/articles/about-code-owners
-# for more info about CODEOWNERS file.
-
-# These owners will be the default owners for everything in
-# the repo. Unless a later match takes precedence.
-* @GoogleCloudPlatform/devrel-flagship-app-maintainers @yoshi-approver
+# DevSecOps project ownership
+* @almecc

.github/workflows/security-ci.yml

@@ -0,0 +1,61 @@
+name: CI - DevSecOps Security Checks
+
+on:
+  pull_request:
+  push:
+    branches:
+      - devsecops-init
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.21'
+
+      # ----------------------
+      # Secret Scanning
+      # ----------------------
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # ----------------------
+      # Go Static Analysis
+      # ----------------------
+      - name: Run gosec (Go SAST)
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@latest
+          gosec ./...
+
+      - name: Run govulncheck (Go dependency vulnerabilities)
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+      # ----------------------
+      # Generic SAST
+      # ----------------------
+      - name: Run Semgrep
+        uses: returntocorp/semgrep-action@v1
+        with:
+          config: p/default
+
+      # ----------------------
+      # IaC & Helm Security
+      # ----------------------
+      - name: Run Checkov (IaC scan)
+        uses: bridgecrewio/checkov-action@master
+        with:
+          directory: .
+          framework: terraform,kubernetes,helm
+
+      - name: Run tfsec (Terraform scan)
+        uses: aquasecurity/tfsec-action@v1.0.3

src/frontend/handlers.go

@@ -444,8 +444,12 @@ func (fe *frontendServer) getProductByID(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	w.Write(jsonData)
 	w.WriteHeader(http.StatusOK)
+if _, err := w.Write(jsonData); err != nil {
+	http.Error(w, "failed to write response", http.StatusInternalServerError)
+	return
+}
+
 }
 
 func (fe *frontendServer) chatBotHandler(w http.ResponseWriter, r *http.Request) {
@@ -491,7 +495,12 @@ func (fe *frontendServer) chatBotHandler(w http.ResponseWriter, r *http.Request)
 	}
 
 	// respond with the same message
-	json.NewEncoder(w).Encode(Response{Message: response.Content})
+	w.WriteHeader(http.StatusOK)
+if err := json.NewEncoder(w).Encode(Response{Message: response.Content}); err != nil {
+	http.Error(w, "failed to encode response", http.StatusInternalServerError)
+	return
+}
+
 
 	w.WriteHeader(http.StatusOK)
 }